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Abstract 

In 2006, 9-variable Boolean functions having nonlinearity 241, which is strictly greater 
than the bent concatenation bound of 240, have been discovered in the class of Rota- 
tion Symmetric Boolean Functions (RSBFs) by Kavut, Maitra and Yiicel. To improve 
this nonlinearity result, we have firstly defined some subsets of the n- variable Boolean 
functions as the "generalized classes of /c-RSBFs and fc-DSBFs (/c-Dihedral Symmet- 
ric Boolean Functions)", where k is a positive integer dividing n and fc-RSBFs is 
a subset of /-RSBFs if A; < I. Secondly, utilizing the steepest-descent like iterative 
heuristic search algorithm used previously to identify the 9-variable RSBFs with non- 
linearity 241, we have made a search within the classes of 3-RSBFs and 3-DSBFs. 
The search has accomplished to find 9-variable Boolean functions with nonlinearity 
242 in both of these classes. It should be emphasized that although the class of 3- 
RSBFs contains functions with nonlinearity 242; 1-RSBFs or simply RSBFs, which is 
a subset of 3-RSBFs, does not contain any. This result also shows that the covering 
radius of the first order Reed-Muller code R(l, 9) is at least equal to 242. Thirdly, 
motivated by the fact that RSBFs are invariant under a special permutation of the 
input vector, we have classified all possible permutations up to the linear equivalence 
of Boolean functions that are invariant under those permutations. Specifically, for 
9-variable Boolean functions, 9! possible permutations are classified into 30 classes; 
and the search algorithm identifies some of these classes as rich. The rich classes 
yield new Boolean functions with nonlinearity 242 having different autocorrelation 
spectra from those of the functions found in the generalized 3-RSBF and 3-DSBF 
classes. However, there is no zero value in the Walsh spectra of these functions; 
hence, none of them can be linearly transformed to 9-variable balanced functions 
with nonlinearity 242. 
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1 Introduction 



On odd number of input variables n, constructing Boolean functions with maximum pos- 
sible nonlinearity is an unsettled open problem in the area of cryptography and combi- 
natorics. The problem is also related to the upper bound [2 n_1 - 2? -1 J on the covering 
radius of the first order Reed-Muller code [5], which is later improved [H] as 2|_2 n ~ 2 — 2a~ 2 J. 
Boolean functions on even number of input variables n, attaining maximum nonlinearity 
of (2™ _1 — 2^~ 1 ) are called the bent functions [21] . For odd n, the nonlinearity value 
(pn-i _ 2^r~ ) is known as the bent concatenation bound, since the concatenation of two 
bent functions on {n — 1) variables yields n- variable functions achieving this bound. In 
Table 1, we present the bent concatenation bound for 7 < n < 15, together with recent 
nonlinearity results. 



Table 1. Summary of Nonlinearity Results for n = 7, 9, 11, 13, 15. 



n 


7 


9 


11 


13 


15 


i Yl — 1 

Bent Concatenation Bound: 2™ — 2~2~ 


56 


240 


992 


4032 


16256 


Nonlinearity Results in [111 




241 


994 


4036 


16264 


Our Nonlinearity Results 




242 


996 


4040 


16272 


Patterson- Wiedemann Construction [19J 










16276 


Upper Bound [9] 


56 


244 


1000 


4050 


16292 



For odd n < 7, it is known that the maximum nonlinearity is equal to the bent con- 
catenation bound [H HE]- Clearly, as the number of n- variable Boolean functions (2 2 ") 
increases super-exponentially as n increases, exhaustive search of the whole space is not 
feasible for n > 7 with currently available hardware. Therefore, for any search attempt, 
different subclasses of Boolean functions are always significant and interesting. 

In 1983, Patterson and Wiedemann [19] demonstrated a construction in the idempo- 
tent class, of 15-variable Boolean functions with nonlinearity 16276 (exceeding the bent 
concatenation bound by 20), using combinatorial techniques and search methods. Since 
then, it has been possible to get functions with nonlinearity (2 n_1 — 2 Ii 2 _ + 20 x 2 IL 2^ 1 ) for 

n — 15 

odd n > 15, which exceeds the bent concatenation bound by 20 x 2~ a - . Until 2006, the 
maximum nonlinearity known for the cases of n = 9, 11, 13 was equal to the bent concate- 
nation bound. In 2006, 9- variable Rotation Symmetric Boolean Functions (RSBFs) with 
nonlinearity 241 (= 2 9_1 — 2~ + 1) were discovered [11] . which led to the construction 

71 — 9 

of functions with nonlinearity exceeding the bent concatenation bound by 1 x 2^~, for 
odd n > 9 (see Table 1). Such functions were attained utilizing the steep est- descent like 
iterative algorithm that first appeared in [TH] and then suitably modified in [TT] for a search 
in the class of RSBFs. 

The class of Rotation Symmetric Boolean Functions seems to be rich in terms of highly 
nonlinear functions and there is a close relation between RSBFs and idempotents [5, 6J. 
Considering a Boolean function / as a mapping from GF(2 n ) GF(2), the functions 
for which f(a 2 ) = f(ct) for any a G GF(2 n ), are referred to as idempotents. As pointed 
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out in [5J E] , the idempotents can be regarded as Rotation Symmetric Boolean Functions 
with proper choice of basis. In [TH], 15- variable Patterson- Wiedemann functions having 
nonlinearity 16276 are also identified in the idempotent class. 

As the space of the RSBF class is much smaller (« 2~) than the total space of Boolean 
functions (2 2 ™) on n variables, it is possible to exhaustively search the space of RSBFs up 
to a certain value of n. In [10], an exhaustive search carried out for the whole space (2 60 ) 
of 9- variable RSBFs exploiting some combinatorial results related to the Walsh spectra of 
RSBFs, has shown that there is no RSBF having nonlinearity greater than 241. Conse- 
quently, in order to find functions with higher nonlinearity, one needs to increase the search 
space. 

Motivated by this fact, we have firstly proposed the generalized fc-RSBFs, as functions 
which satisfy f(a 2 ) = f(a), where 1 < k \ n. Note that if k — 1, the resulting functions 
are the same as idempotents; whereas for k = n the entire space of n-variable Boolean 
functions is covered. In the space of generalized fc-RSBFs, imposing the condition of 
invariance under the action of dihedral group, we have defined the class of generalized 
A;-DSBFs subset of A;-RSBFs. 

Secondly, we have used the steepest-descent like iterative algorithm in [H] for a search in 
the generalized 3-DSBF and 3-RSBF classes. This search has successfully ended up with in- 
variable functions in both of these classes, having nonlinearity 242, absolute indicator values 
32, 40 and 56. This result shows that the covering radius of the first order Reed-Muller 
code R(l, 9) is at least 242. This result is also important for n = 11 and n = 13, since the 
bent concatenation of 9-variable functions with nonlinearity 242 leads to the construction 
of 11-variable and 13- variable functions with nonlinearity (2 n_1 — 2~^~ + 2 x 2 _ 2 _ ), which 
exceeds the bent concatenation bound by 2 x 2 I! 2 _ (see Table 1). However, we should 
mention that for odd n > 15, the nonlinearity (2 n_1 — 2 I V~ + 20 x 2 2L ^~~ ) given in [TH] 
that can be obtained by concatenating 15-variable Patterson- Wiedemann functions is still 
greater than the nonlinearity (2 n_1 — 2~^~ + 2 x 2~%~). 

Thirdly, knowing the fact that RSBFs, DSBFs, as well as the generalized /c-RSBFs 
and fc-DSBFs are invariant under some special types of permutations on input vectors, we 
have focused on the same search problem from a different direction and considered the 
possibility of other 'nc/i' classes that are invariant under some permutations. Linearly 
equivalent Boolean functions have the same nonlinearity; therefore, while searching for 
highly nonlinear functions, it is quite logical to classify all n\ permutations up to the linear 
equivalence of Boolean functions that are invariant under them. More specifically, for 9- 
variable Boolean functions, we have classified 9! many permutations into 30 classes which 
are different up to the linear equivalence of Boolean functions that are invariant under 
them. Then for each class, by picking up a representative permutation arbitrarily, we have 
searched the corresponding set of Boolean functions. Consequently, in some of these sets, 
we have obtained 9-variable Boolean functions with nonlinearity 242 and absolute indicator 
values 40, 48 & 56. So, our aim of defining other 'rzc/i' classes is accomplished. We note 
that, however, the functions presented in this paper do not contain any zero in their Walsh 
spectra, and hence, they cannot be linearly transformed to balanced functions. 
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In the following section, after reviewing some basic definitions related to Boolean func- 
tions, we present preliminaries of permutation group actions. In Section 3, we introduce 
the generalized rotation symmetric and dihedral symmetric Boolean functions. Classifica- 
tion of permutations on inputs of 9-variable Boolean functions, with respect to the linear 
equivalence of Boolean functions that are invariant under them, is presented in Section 4. 
Different results related to 9-variable Boolean functions with nonlinearity 242 are presented 
in both Section 3 and Section 4. Finally, some additional 11 and 13- variable DSBFs, which 
are attained by the steepest-descent like search algorithm with nonlinearities 994 and 4036 
respectively, are presented in Section 3. It should be noticed that those functions have 
exactly the same nonlinearities, as those would be obtained by concatenating 9-variable 
functions with nonlinearity 241. 



2 Preliminaries 
2.1 Boolean Functions 

An n- variable Boolean function f(x) produces a single-bit result for each n-bit input vector 
x = (xo, . . . ,x n -i), which may be considered as a mapping from {0, l} n into {0, 1}. f(x) 
is basically represented by its truth table, that is, a binary vector of length 2 n , 

/= [/(0,0,...,0),/(l,0,...,0),/(0,l,...,0),...,/(l,l,...,l)]. 

We represent the set of all n- variable Boolean functions by B n ; clearly \B n \ = 2 2 ™. A binary 
vector g has the Hamming weight wt(g) equal to the number of its nonzero elements. The 
Hamming distance between two binary vectors g and h, both having the same length, is 
defined as the number of places for which g and h differ, i.e., d(g, h) = wt(g © h), where 
© denotes the addition over GF(2). An n- variable Boolean function / is called balanced if 
wt(f) = 2 n -\ 

The algebraic normal form (ANF) of a Boolean function is defined as its unique repre- 
sentation in the form of a multivariate polynomial over GF(2), 

/(xq, . . . , x n _\) = c © OiXi © a^XiXj © ... © oqi n _iXQXi . . . x n _i, 

0<i<n-l 0<i<j<n-l 

where the coefficients c, a,, a^, . . . , aoi... n -i £ {0,1}. The algebraic degree, or simply the 
degree of /, is the number of variables in the highest order product term with nonzero 
coefficient, which is denoted by deg(f). 

A Boolean function is called affine if its degree is at most one. The set of all n-variable 
affine functions is represented by A n . The nonlinearity of an n- variable Boolean function 
/ is defined as its minimum distance to any affine function, i.e., 

nl(f) = mm(d(f,g)). 

geA n 

Boolean functions used in cryptographic systems must be highly nonlinear to resist Best 
Affine Approximation (BAA) and correlation attacks [31 H] • 
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The Walsh transform of an n- variable Boolean function f(x) is an integer valued func- 
tion over {0, 1}™ defined as 

W f {w)= (-l) f(x) (-l) <x ' w> , 

xG{0,1}" 

where x = (x , . . . , x n _i), w = (w , . . . , u>„_i) G {0, 1}" and < x, w >= x w © . . . © 

X n _lW n _l. 

The nonlinearity of an n- variable Boolean function f(x) can be alternatively expressed 
by means of its Walsh spectrum, i.e., 

nl{f) = \{2 n - max \W f (w)\. 
The autocorrelation function of f(x) is given by 

r f (d)= (-iy {x \-iy {x(Bd \ 

x£{0,l} n 

where d = (d , . . . , <i n _i) G {0, 1}™. The autocorrelation value having maximum magnitude 
except the origin is also known as the absolute indicator [24J and denoted as 

Af = max \rf(d)\. 
J (#(o,...,o)e{o,i}" 

A Boolean function is balanced if and only if its Walsh spectrum value is zero at 
the origin. On the other hand, if an unbalanced Boolean function g(x) contains a zero 
in its Walsh spectrum except the origin, say W g (u) = and u ^ (0, ...,0), it can be 
linearly transformed into a balanced function f(x) = g(x)(B < x, u >, which has the same 
nonlinearity and absolute indicator; i.e., nl(f) = nl(g) and Af = A g . 

2.2 Group Action by Permutation Groups 

A group G is said to act on a set X if there is a mapping <ft : G x X —>■ X denoted as g • x, 
which satisfies the following two axioms for all elements x G X. 

1. e ■ x = x where e stands for the identity element of G. 

2. g ■ (h ■ x) = (gh) ■ x for all g,h G G. 

The mapping is called the group action and the set X is called a G-set. The orbit of x 
is defined as the set G(x) = {g ■ x \ g G G}, i.e., the group action moves x to its orbit. 
As the set of orbits of X under the action of G, denoted by Q, constitutes a partition of 
X, the corresponding equivalence relation is defined by x ~ y iff there exists a g G G such 
that g ■ x = y. Hence, the orbits form the equivalence classes under this relation. 
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Let G be a permutation group acting on {0, l} n , and consider the class of n- variable 
Boolean functions which are invariant under the action of G, i.e., any Boolean function 
/ in the class satisfies the condition for each x G {0, l} n , f(x) = f(y), for all y G G(x). 
As a consequence of the invariance property, the class composes a subclass of B n , and 
knowing the number of orbits, i.e., \Q\, it contains 2' e ' many n- variable Boolean functions, 
each satisfying the given condition. The value of \Q\ can be determined using Burnside's 
Lemma. 

Lemma 1 (Burnside's Lemma) Let G be a group of permutations acting on a set X, 
and fixx(g) = {x G X | g ■ x = x} for each g G G. Then the number of orbits induced on 
X is given by 

Trr^\fixx(g)\- 

1 1 geG 

Let us represent an orbit by its lexicographically first element denoted by Aj. The 
Boolean function / which is invariant under the action of G, can be represented by 
(/(A ), • • • , /(A|g|_i)), where A , . . . , A|<?|_i are again arranged lexicographically. Clearly, 
this representation is shorter than the truth table of /. Further, it can be shown [23] that 
Wf(u) = Wf(v) if u G G(v), implying that the Walsh spectrum of / can be at most \Q\ 
valued. Then, defining a \Q\ x \Q\ matrix M as M.\,j = XLgGa (—l) <x ' Aj> , the Walsh 
spectrum of / can be calculated as [23J 

W/(A J -)=E(- 1 ) /(A<) ^«- 

i=0 

3 Generalized Rotation and Dihedral Symmetric 
Boolean Functions 

After briefly summarizing RSBFs, we propose the generalized classes of fc-RSBFs and k- 
DSBFs in Definition 1 and Definition 2 respectively. Letting (xo,xi, . . . , x n _i) G {0, l} n , 
the (left) i-cyclic shift operator p l n on n-tuples is defined as 

P n (^0) 3Cl i • • • j ^n— 1 ) (*^(0+i) mod nj • • • j % (n—l+i) mod n) 5 

for 1 < % < n. 

A Boolean function / is called rotation symmetric if for each input (xq, . . . , aV-i) ^ 
{0, l} n , f(p 1 n (x , . . . , x n -i)) = f(xo, . . . , x n -i). That is, RSBFs are invariant under all 
cyclic rotations of the inputs. The inputs of a rotation symmetric Boolean function can 
be divided into orbits so that each orbit consists of all cyclic shifts of one input. An orbit 
generated by (x , x lf . . . , x n -i) is denoted by G n {x , Xi, . . . , x n - X ) = {p\(x Q , Xi, . . . , x n -t) \ 
1 < i < n} and the number of such orbits is represented by g n (~ 2~). More specifically, 
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g n is equal to \ J2t\n 4>(t)2T [22J , where is the Euler's phi-function. The total number 
of n- variable RSBFs is 2 9n . 

In the following, we define the generalized RSBFs as fc-rotation symmetric Boolean 
functions (fc-RSBFs). 

Definition 1 Let 1 < k < n, k \ n. An n-variable Boolean function f is called k-rotation 
symmetric if for each input (x , . . . ,a;„_i) G {0, l} n , f(p k n (x , . . . , x n _i)) = f(x , . . . , x n _i). 

As can be seen, the /c-rotation symmetric Boolean functions are invariant under /c-cyclic 
rotations of inputs. Therefore, an orbit of a fc-RSBF generated by (x ,xi, . . . , x n _i) is 
G k n (xo, xi, . . . , x n _i) = {p\(xo, xi, . . . , x n -i) \ i = k, 2k, 3k, . . . , n}. For example, G 3 g(001 
001 111) = {(001 001 111), (001 111 001), (111 001 001)}. 

If g n ^k is the number of distinct orbits in the class of fc-RSBFs of n variables, one can 
show that g n k = - ^ ( i 2 0(t)2f (?s 2 fcx ^"), where 4>(t) is the Euler's phi function. 

I k 

The class of Dihedral Symmetric Boolean Functions (DSBFs) [T7j, a subset of the RSBF 
class, is invariant under the action of the dihedral group denoted by D n . In addition to the 
(left) i-cyclic shift operator p l n on n-tuples, which is defined previously, the dihedral group 
D n also includes the reflection operator r n (xo, x\, . . . , x n -\) = (x n _i, . . . ,x±, x ). The 2n 
permutations of D n are then defined as {p 1 n , p 2 n , ■ ■ ■ , p n ~ 1 n , p n n , T n p 1 n , r n p 2 n , . . . , r n p n ~ 1 n , 
r n p n n }. The dihedral group D n generates equivalence classes in the set {0, l} n [2D]. Let d n 
be the number of such partitions. The following proposition gives the exact count of d n |7, 
page 184], [T7|. 

Proposition 1 Let d n be the total number of orbits induced by the dihedral group D n act- 
ing on {0, l} n . Then d n = g n /2 + I, where, g n = - X]i|n^(^)2 T the number of rotation 
symmetric classes [22]? 4>{t) is the Euler's phi-function and 

( |2?, if n is even, 



Since there are 2 dn many n-variable DSBFs and d n ~ 2an ; a reduction in the size of the 
search space over the size of RSBFs is provided. 

Definition 2 Let 1 < k < n, k \ n. An n-variable Boolean function f is called k-dihedral 
symmetric if f is invariant under the group action D k n = {p\, T n p l n \ i = k, 2k, 3k, n}. 

As the class of DSBFs is a subspace of fc-DSBFs, we call /c-DSBFs "generalized dihedral 
symmetric Boolean functions". One should observe that /c-DSBFs is a subspace of k- 
RSBFs. 

When Proposition 1 is applied to fc-dihedral symmetric functions, we obtain the follow- 
ing corollary. 
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Corollary 1 Let d n ^ be the number of distinct orbits, in the class of k-DSBFs of n vari- 
ables. Then, d n ^ = g n ^/2-\-l, where, g n ^ = ^ J^tp <f>(t)2~t is the number of k-rotation 
symmetric classes, <p(t) is the Euler's phi-function and 

{2? _1 , if n is even, k is even, 
|2f , if n is even, k is odd, 
2~^~ , if n is odd. 

Table 2 compares the orbit counts of fc-rotational classes, £;-dihedral classes, RSBFs 
and DSBFs for k\n,n < 15. 



Table 2. Comparison of the Orbit Counts g n ^d n) g n: k and d n ^ (for n = 4, 6, ...,15, and all 
integers k, which divide n). 



k 

n 


2 


3 


4 


5 


6 


7 


4 


g 4 = 6 


54,fc 


10 












d 4 = 6 


d^k 


7 












6 


56 = 14 


9&,k 


24 


36 










d 6 = 13 


de,k 


16 


24 










8 


58 = 36 


98,k 


70 




136 








d 8 = 30 


dg,k 


43 




76 








9 


59 = 60 


59,fc 




176 










d 9 = 46 


d9,k 




104 










10 


5io = 108 


5io, fe 


208 






528 






d w = 78 


^10,fc 


120 






288 






12 


512 = 352 


5l2,fc 


700 


1044 


1376 




2080 




d 12 = 224 


du,k 


382 


570 


720 




1072 




14 


514 = H82 


5l4,fc 


2344 










8256 


di4 = 687 


^14,fc 


1236 










4224 


15 


515 = 2192 


5l5,fc 




6560 




10944 






d 15 = 1224 


^15,fc 




3408 




5600 







As mentioned previously, we have utilized the steepest-descent like iterative search 
algorithm, which was used to discover 9- variable RSBFs having nonlinearity 241 [IT] . The 
details, which can be found in the related literature, are extraneous for present purposes. 
We note only that it is an efficient search technique with an outstanding ability to escape 
from local optima. 



3.1 9- variable 3-DSBFs and 3-RSBFs 

We have applied the search to 9-variable 3-DSBFs for which the size of search space is 2 104 
(see Table 2). We have found several unbalanced Boolean functions having nonlinearity 
242. Among them there are two different absolute indicator values, which are 32 and 40. 
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The following is the truth table of a 9-variable, 3-dihedral symmetric Boolean function 
having nonlinearity 242, absolute indicator value 40, and algebraic degree 7: 

68B7EF2DA03B0D3EA00DB6A96DD99AEAFDB9C842B6D5DC8C4526CE0DD29020DB 
B75FE3314568344E73688FF0CB2482E065231869E1AA4583765CC491F8A8DB12 

And, the function below is another 9-variable 3-DSBF having nonlinearity 242, absolute 
indicator value 32, and algebraic degree 7: 

125425D30A398F36508C06817BEE122E250D973314F976AED58A3EA9120DA4FE 
0E4D4575C42DD0426365EBA7FC5F45BE9B2F336981B5E1863618F49474F6FE00 

Using a computer system with Pentium IV 2.8 GHz processor and 256 MB RAM, a 
typical run of the search algorithm takes 1 minute and 17 seconds. We have carried out 
100 runs, each each starting with a randomly chosen Boolean function in the space of 
9-variable 3-DSBFs. The algorithm has produced 152 functions with the nonlinearity 241, 
and 36 many 3-DSBFs having nonlinearity 242. 

Additionally, we have applied the search strategy to 9-variable 3-RSBFs (the size of 
the search space is now 2 176 as can be seen from Table 2), for which we initiate the search 
algorithm with a 9-variable 3-DSBF having nonlinearity 242. Then we have obtained some 
9-variable 3-RSBFs (which are not in 3-DSBFs) having nonlinearity 242, absolute indicator 
56, and algebraic degree 7. The following is the truth table of such a function: 

3740B6A118A1E19642A85E2B7E2F3C3CB65FA0D95EC9DB1EA92BDB3666185AE0 
087F5FE6E0757106A12FC918754C40E8A1BCCB7A714032A8961456E066E8A801 

It is clear that using one of the above 9-variable functions (say /) and a 2-variable 
bent function (say g), the 11-variable function g(yo,yi) © f(%o, ■ ■ ■ ,Xs) with highest -till 
date- nonlinearity of 2 11_1 — 2~^~ + 4 = 996, can be obtained. Similarly h(y Q , yi, y 2 , y?) ® 
f(xQ, . . . ,x&) is the most nonlinear 13-variable function known to date, with nonlinearity 
2 13_1 — 2^a~ + 8 = 4040 where h is a 4- variable bent function and / is one of the above 
9-variable functions with nonlinearity 242. We think this is a significant improvement on 
the results of [TT]. However, since the nonlinearity (2 n ~ 1 — 2~^~ + 2 x 2 _ 2 _ ), which can be 
obtained by bent concatenation of 9-variable functions with nonlinearity 242 is less than 
the nonlinearity (2 n ^ 1 - 2^ + 20 x 2 2 ° ) given in [19] for odd n > 15, this result is 
significant only for odd 13 > n > 9. 

3.2 11 and 13-variable DSBFs 

In [T7], the class of Dihedral Symmetric Boolean Functions (DSBFs), a subset of the RSBF 
class, which is invariant under the action of the dihedral group, is introduced. It has been 
shown that some of the 9-variable RSBFs having nonlinearity 241 also belong to this subset, 
demonstrating the richness of DSBFs in terms of high nonlinearity. Motivated by this, we 
have carried out a systematic search in the DSBF class for 15 > odd n > 9, and found 
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Boolean functions having nonlinearity > 2 n_1 — 2 I! 2 J \ More specifically, for 11-variable 
DSBFs, we have attained an 11-variable DSBF with nonlinearity 994 within the space of 
size 2 126 . For 13- variable DSBFs, in order to reduce the search space (2 380 ), we have applied 
some additional permutations on input vectors, and obtained a subset of size 2 74 , in which 
we have found several 13-variable DSBFs with nonlinearity 4036. Consequently, our trials 
confirm that the DSBF class contains highly nonlinear Boolean functions and it is a rich 
subset of the RSBF class for n = 11, 13, as well. We should also mention that, this is the 
first demonstration of Boolean functions on odd number of input variables 9 < n < 15 
having nonlinearity greater than the bent concatenation bound, which are not obtained by 
the bent concatenation of 9- variable Boolean functions with nonlinearity > 240. 

For the 11-variable DSBF case for which the size of search space is 2 126 , we have carried 
out 8000 runs of the search algorithm, and found the following 11-variable DSBF having 
nonlinearity 994, absolute indicator value 200, and algebraic degree 9: 

68C1F052AA14260999DD0365487844C6C397A7B6114A787724957BC46471F12D 
F05F873ECC6E8A29034265887BD17A2A483583367B8FF1312C347E12FA1708F3 
AA1433AF952B5BE9B5F02CA891985C92114A640C2D6380C57B9BB3027E991D8D 
34C45B66D00E5B7D6ACF80EEAB021A430CE54E707AAD520DAB9D472F4081FF1F 
89CC06215F1B8CAA973658CF27DAADD3CF36AA0118B0DDC08716D3D526E4C70D 
065371D97C2054E458A2390BD550E5736ADAC2DF8B0A10492BACC3C317B381F7 
1A21F52076CB3C3DB60144F836DF2AB32DDDE0EAC051FCBD8C8F10491299751F 
41F0E96761AC6F053F888DE7234945F79C9B92B3703B19BF6545C557BBBF57FF 

A typical run of the search algorithm takes 1 minute and 16 seconds using the same 
computer system. 

For the 13-variable DSBF case, since its search space is huge (2 380 ), before starting 
the search we apply the following permutation in addition to the permutations of dihedral 
group on input vectors 

T[(x , Xi, . . . , Xi 2 ) = (X , X 2 , £4, x 6, Xg, Xio, X12, Xx, £3, £5, X 7 , X 9} X U ) 

such that for each input (xq, . . . , 212) G {0, l} 13 , 

f(p 1 n (x , . . . , X12)) = f(r n (x , . . . , X12)) = f(n(x , x l2 )) = f(x , x 12 ), 

and the search space of 13-variable DSBFs is reduced from 2 380 to 2 74 . Note that this 
permutation constitutes a subset of 13-variable DSBFs for which, using similar combinato- 
rial methods as in [TU], it may be possible to carry out an exhaustive search to enumerate 
13-variable DSBFs with nonlinearity > 4036, with a reasonable amount of computational 
power. We have carried out 500 runs of the search algorithm, and found two 13-variable 
DSBFs having nonlinearity 4036 in this subset. One of them with nonlinearity 4036, ab- 
solute indicator value 208, and algebraic degree 10 is given below: 

177E7EF97EFCFF937FF8EBA0FAFBC71A7EFBEAD0EC8B8815EA99FADEA12A568D 
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7EE8EA8BF889B215FDB1848F80950677EDC883D3AE9DB2ED9D031888277CD4F7 
7FEDE881ECDC948AFF90D0968B0C0676EFE3CE028524D4FAC114C666116C2A6B 
F8E2A195815AF71A89FCD3A29B48BDE3C7F6155F139090904C2B2AA1F321AA3F 
7EEEF8B2E881D107ECA1E3B5C665D088EAAE9354A710C37C81CB04E4156C3A28 
ECAFEC0AB5ED504C85361D75B325AA88F4560730A4386C7C13537CF04CCD299B 
FA85B81D9C129772D143368CFE2A43C88096AEB4B35E8809D3DE64959BE7A90E 
A12BBF7D077227FA034FC601D340931535A159CF4C88CC17BB0B4D13C8990BAE 
7EFCE8ACEAC18B0DE881C517E253407FF8F4C917EC5E9F32A12C3826F700C081 
F889C9F8934B2770DC7B5710F44F2EF09146A5CA1530BD3107663CA14BCD0C81 
F9A18DABB9F411C88A26ECF6364474B484321F7D47E33B779B5E58679CCD85D5 
FA35626C042E4E419C244A902CF12EF5420E660B6EA0EE0570A0A4B64D86979E 
FFCDD1728BC516A786F10348976A7F09B212350A0A78D5F1BFA85CD8350BA194 
C015D72899F98F208E1B73E9C0950093B24AE7B96C65933782CAFC7BCCD715BC 
9D0208CA8AAA7FE2147A2E49192BFBCD145A74FAF0790003E75B7451930B1736 
1E76880372D3A1AB70F18590E1F5177A8E8B449F61B2075AF08597D6519ECCE9 
7EEDEEF5FC90CDB4ED8CA10785CE10E3E881C147F523072FB81D274B71403EEF 
FB81AE60F4C6122EB9A032EC96AA5A09C8171CF41ED05879BE7F5444A101D107 
EAC481D3A197ABC0825E349E192A7A40A3A07BCA367F5300EE3424AE5DECAB15 
C347647CD962E09806265E01DEA75B12117F3C3C1BA1D85771DBA0A751B58512 
EE82891381B78D8FCE97AE741242F081C19C593CEDF4EB2C5A3874753A619B21 
D1315E5802AE6AE6247FB95F5ECB6B3FC78A22A962842D2F82A1A0A3C026B276 
FBDC1B632D1878F144700CFD70EC711687F05D3025D9870548B5AB5708EDAF76 
700800F86C2951DB6CECCD01BDED51766E01CD11CD349F7C21A7943CC37ED6A9 
EBAFE4B6B2133A49819BF1334739D86BD128EA42504A60C1876E6CCD6FEA11D3 
8A1D17180E6650C810D86FD0A622FA179BAED88422E1E3D45F6651CFDD03D734 
A0151733A72E48C196D6BE92C4EF4951D5EC028A2F5FE997B00182330101824E 
DE5934CDAC2FCAD63CF43D33871F0B3EC00CA1DDAAB17BDEA1B5B67E13669EE1 
93A6454915D5B5C9D088C8893AABB85D07742AC84CBC20C752C2099EFADBF1F6 
077532896E64AB9DFA003F974105110AED6B238E6E753716821F05DE176E5A69 
52B97F79C081414F3E08A60BC816CDDE3F41AA17C0779350B912AF76073E7AC9 
C5FD819B602186BE79078F5C543E36C9BF158126D33EE6697712D6A9F4E1E997 

In this case, a typical run takes one minute using the same computer system. Since these 
results confirm that the DSBF class contains highly nonlinear Boolean functions on 11 
and 13-variables as well, it would be an interesting and open problem to attain some rich 
subsets achieving higher nonlinearity in the DSBF class. 

4 Permutations on Input Vectors of 9-variable 
Boolean Functions 

As it is deduced from the discussion in the preceding section, RSBFs are invariant under 
a special type of permutation. To search for better cryptographic characteristics, we con- 
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sider the possibility of other classes of Boolean functions that are invariant under some 
permutations. Since linearly equivalent functions have the same nonlinearity, it makes 
sense to classify all n! permutations up to the linear equivalence of Boolean functions that 
are invariant under them. The classification is based on the following proposition, which 
is easy to prove. 

Proposition 2 Let f and g be Boolean functions which are invariant under arbitrary per- 
mutations 7Tj and n g respectively. Then, f and g are said to be linearly equivalent if there 
exists a bijective linear mapping L : {0, l} n —>■ {0, 1} such that ttj = (L^ 1 o 7i g o L). 

Proof. Suppose f(x) = g(L(x)), i.e., / = g o L. Then, it holds that 

f = goL = gon g oL = fo L~ x oix g oL = foiXf. 

Thus, we classify all possible permutations up to the equivalence 

iif ~ ix g ^ 3L such that ixj = (L o ix g o L). 

The classification can be accomplished through a computer program by exploiting the 
Jordan Normal Form for matrices. Specifically for 9- variable Boolean functions, all permu- 
tations of the identity matrix (362, 880 many) yield that there are only 30 permutations 
(see Table 3), which are different up to the equivalence defined above. Then, we apply 
the search algorithm for each class using its representative permutation and determine 
the corresponding nonlinearity given in the last column of Table 3. Our results show the 
existence of permutations having similar cryptographic characteristics with /c-RSBFs and 
fc-DSBFs. 

From Table 3, it is seen that we have attained several 9-variable Boolean functions 
with nonlinearity 242, which we initially found in 3-DSBFs and 3-RSBFs, in the classes 
with sizes 2 100 , 2 104 , 2 140 . In the following, we present 9-variable Boolean functions having 
nonlinearity 242 and different autocorrelation spectra from those of the functions found in 
3-DSBFs and 3-RSBFs. 

We have applied 100 runs of the search algorithm [TT] to the space of size 2 104 and 
found two 9-variable Boolean functions with nonlinearity 242, absolute indicator value 48, 
and algebraic degree 7. A typical run takes the same amount of time as for the case of 
3-DSBFs (since the sizes of both spaces are the same). One of these functions is given 
below: 

7B8F94BAD364DAC9931906F9465FF33E921E13D7552DAFD684757B662FDA3C68 
FA8D94B3C3659B5FCC46FD1518050F97A1E02039AAF74337134F30AB5B41D9DE 

which is invariant under the representative permutation 

tt(x , Xi, . . . , x 8 ) = (x , x 2 , x u x 4 , x 5 , x 6 , x 7 , x 8 , x 3 ). 
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Table 3. Classification of all possible 362, 880 many permutations for 9-variable Boolean func- 
tions, and the best achieved nonlinearity result for each class. 







Maximum 


Total 








number of 


number of 


Best achieved 


Representative 


Number of 


input vectors 


distinct 


nonlinearity 


permutation 


permutations 


in an orbit 


orbits 


result 


(0,1,2,3,4,5,6,7,8) 










(identity) 


1 


1 


512 


239 


(5,7,4,8,2,0,6,1,3) 


945 


2 


272 


240 5 


(3,1,7,0,5,4,6,2,8) 


1260 


2 


288 


240 


(7,1,2,3,5,4,6,0,8) 


378 


2 


320 


240 


(0,8,2,3,4,5,6,7,1) 


36 


2 


384 


240 


(4,6,7,2,8,1,5,3,0) 


2240 


3 


176 


242 3,4 


(5,1,2,4,7,8,6,3,0) 


3360 


3 


192 


240 


(0,1,2,8,4,5,6,3,7) 


168 


3 


256 


240 


(1,4,7,5,6,2,0,3,8) 


11340 


4 


140 


242 2 


(4,7,5,6,0,1,3,2,8) 


11340 


4 


168 


240 


(0,2,1,7,4,3,5,6,8) 


7560 


4 


176 


240 


(0,8,2,3,4,1,6,5,7) 


756 


4 


192 


240 


(0,7,2,5,4,1,3,6,8) 


3024 


5 


128 


239 


(8,7,3,0,1,6,2,4,5) 


20160 


6 


100 


242 1 


(0,2,1,4,5,6,7,8,3) 


30240 


6 


104 


242 


(7,1,0,3,4,2,8,6,5) 


10080 


6 


112 


240 


(7,4,0,5,1,8,6,2,3) 


10080 


6 


144 


240 


(8,4,3,2,1,7,5,6,0) 


2520 


6 


144 


240 


(0,6,2,7,8,1,5,3,4) 


7560 


6 


160 


240 


(8,1,3,2,4,5,0,7,6) 


2520 


6 


192 


240 


(2,0,6,1,4,5,7,8,3) 


25920 


7 


80 


240 


(0,3,5,8,1,4,7,2,6) 


45360 


8 


72 


240 


(1,6,7,4,8,2,5,3,0) 


40320 


9 


60 


241 5 


(5,8,6,7,2,0,1,3,4) 


9072 


10 


80 


240 


(1,3,8,7,4,0,6,5,2) 


18144 


10 


96 


240 


(3,5,7,1,6,0,8,2,4) 


15120 


12 


88 


240 


(0,2,7,8,4,6,3,1,5) 


15120 


12 


96 


240 


(4,5,7,1,0,8,3,6,2) 


25920 


14 


60 


240 


(6,5,1,4,7,2,3,0,8) 


24192 


15 


64 


238 


(4,8,1,2,6,7,5,0,3) 


18144 


20 


48 


240 



1 Nonlinearity result of 242 is attained in the subset of size 2 74 in the set of size 2 1 ' 

2 Nonlinearity result of 242 is attained in the subset of size 2 86 in the set of size 2 1 

3 Nonlinearity result of 242 is attained in the subset of size 2 104 in the set of size 2 

4 The class contains the permutation corresponding to 3-RSBFs. 

5 The class contains the permutation corresponding to RSBFs. 

6 The class contains the permutation corresponding to 9-DSBFs. 
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Then, in order to reduce the search space, we have considered some subclasses. For this 
purpose, we have applied the reflection operator, which is defined as T n (x ,Xi, . . . ,x 8 ) = 
(x$, ■ ■ ■ , x\, xq) for 9-variable Boolean functions, in addition to the representative permu- 
tation. As a result of this method, we have identified a subset of size 2 74 in the set of size 
2 100 . In this subset, we have attained several 9-variable Boolean functions with nonlinearity 
242, absolute indicators 40 and 64, and algebraic degree 7. One of them having absolute 
indicator 64 is provided below: 

0331786B34D878855663A2E961F1CB4F779EBBF6881ABB24AC033E6C2B32E049 
3D0891DB1888EA5E6F910310311532FC68D5F2A4B5BE6445E41F64299F0CC99A 

which is invariant under the permutations of the reflection operator r n and the represen- 
tative permutation 

7r(x , Xi, ... , X 8 ) = (X 8 , X 7 , X 3 , Xq, X X , Xq, X 2 , X 4 , X b ). 

For this case, we have carried out 100 runs of the search algorithm resulting in 9 many 
Boolean functions with nonlinearity 242 such that seven of them with absolute indicator 
value of 64, and the remaining with that of 40. A typical run takes 1 minute and 4 seconds 
using the same computer system. 

5 Conclusions 

By suitably generalizing the class of RSBFs, we have introduced fc-RSBFs, as functions 
which satisfy f(a 2 ) = f(a), where the nonzero positive integer k divides n, and a G 
GF(2 n ). We have also defined the class of A;-DSBFs as a subset of fc-RSBFs imposing the 
condition of invariance under the action of dihedral group. Using the steepest-descent like 
iterative algorithm in (TTJ [T2| for a search in the generalized 3-DSBF and 3-RSBF classes, 
we have attained 9-variable 3-RSBFs and 3-DSBFs with nonlinearity 242. This result shows 
the existence of n-variable Boolean functions having nonlinearity 2 n_1 — 2 _ 2~~ + 2 x 2 _ 3 _ 
for n = 9, 11, 13. In [2], it is conjectured that the covering radius [161 tlH] of R(l, n) is 
even. Our nonlinearity result for n = 9 shows that the covering radius is at least 242 and 
it is an interesting open question to settle it. The upper bounds presented in [HIE] for the 
covering radius of R(l, 9) is 244. 

Further, we have classified all possible permutations up to the linear equivalence of 
Boolean functions that are invariant under them. Specifically for n = 9, there are 30 such 
classes. Exploiting the same search algorithm [11] . we have attained 9-variable Boolean 
functions having nonlinearity 242 in the class of size 2 104 . Then, we have considered 
some subclasses by adding permutation of the reflection operator r n to the representative 
permutation and found many functions with nonlinearity 242 shown in Table 3. As an 
example, we have identified a subset of size as small as 2 74 , in the set of size 2 100 , having 
9-variable Boolean functions with nonlinearity 242. Considering the combinatorial search 
techniques in [TU], we note that it may be possible to exhaustively search the subset of size 
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2 for the enumeration of 9-variable Boolean functions having nonlinearity > 242, with 
a reasonable amount of computational power. Moreover, we have obtained an 11-variable 
DSBF having nonlinearity 994 and several 13-variable DSBFs having nonlinearity 4036, 
which confirm the richness of DSBFs [TT] in terms of high nonlinearity for n — 11 and 13. 

We think that the results that we present contain significant information on the ex- 
istence of maximum nonlinearity-Boolean functions with odd number of input variables, 
within the classes that are invariant under some permutations. 

Acknowledgment. We acknowledge Dr. Gregor Leander for his discussion on linear 
equivalence of Boolean functions that are invariant under random permutations, which has 
helped us find one missing class in Table 3. 
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